Schneier on Security

Clive Robinson • March 13, 2026 12:59 AM

@ StephenM,

With regards,

“Would “restricted” be the lowest level?”

Congratulations, you are the first person to ask the right question…

There are four basic classifications used, but they really are not about “security threats” untill they get to the top which is generally “secret”[1]

Anything below is generally one of two things,

1, Ass covering (endemic).
2, Give prosecutorial leverage.

In the UK for instance the script for your medications we call “a prescription” is classified as “Confidential” for reasons of “celebrity status” and the MSM who look for “if it bleeds it leads” or more favourite to build people up then tear them down.

The result is that the UK “National Health Service”(NHS) network –brought in by the idiot Tony Blair to enrich himself through others–, called by most as “NHSnet” is required to run in encrypted form using a GCHQ designed algorithm “rambutan” and modes that are all classified as “Secret” (even though much of it is public knowledge).

I once had to be compliant with such nonsense as do all UK central and local government employees, those who handle “financial data”, those who handle “medical data”, and those who handle personal data.

Put simply this has created problems… Which is why just for ‘5h1ts & G1ggl3s” it was decided by politicians that the “Information Commissioner’s Office”(ICO) should use an entirely different set of document classifications…

[1] Technically “secret” is the top classification, but the reality is that whilst you may have a security clearance to that level, you are not entitled to just see any “secret” document…

You might have heard the silly expression of “You have not been read in” where it came from I’ve no idea but it sounds great for “entertainment purposes”. In some places documents that are classified horizontally as “secret” are also siloed vertically by what are supposed to be “randomly selected” words as a pair or triple. There is an infamous Scott Adam’s Dilbert cartoon where “Catbert” explains this “random word selection” as being words from a list of “science and nature, terms and names” and that the classified project is now called “Uranus Hertz”.

Clive Robinson • March 13, 2026 5:32 AM

@ Bruce,

On further thinking about @StephenM’s question above, it becomes clear that people do not know about

1, Classified Documents
2, Sensitive Information

In the broad and specific and why there are different rules for them.

As a general rule of thumb,

1, A classified document is a whole traditionally formatted and printed on paper “tangible physical object” that contains one or more pieces of sensitive information in a context.

2, Sensitive information can be just a number or word or inferred meaning in a context that is an “intangible information object” that can be a part or whole of a document.

Because information is not a physical object it is something that is impressed or used to modulate matter or energy used to store, communicate or process the information.

3, So Sensitive information is not constrained to document or parts of documents, it applies to any kind of system or method as part of a system used for,

3.a, storage or retrieval
3.b, communications
3.c, processing.

Of the information.

To be sensitive the information only need be capable or potentially capable of a harm to any entity, that is “Any Person legal or natural” “individually or collectively”.

That is the individual entity, their family/collective, those they work for/with, those they associate with individually or collectively right through all levels to the notion of a nation state.

Harms are usually expressed as either “discriminatory” or that which causes “measurable or estimable harm in financial, psychological or physical harms.

In much law the harm has to pass some or all four tests,

1, The potential for harm exists.
2, The effect and magnitude of the harm can be demonstrated / accounted for.
3, The entity suffering the harm.
4, The entity or entities causing the harm.

To mount a defence the entity or entities have to demonstrate that there either was no harm, or that the harm was necessary for societal good, or the harm was made in a protected space such as a court, or tribunal that is privileged in the legal/professional sense.

Now in the UK recent successive governments are trying to rewrite this, because they want to put data into third party often “arms length” systems to in theory reduce costs, but in practice make surveillance on citizens easier and not subject to challenge or constraint by courts such as the “European Court of Human Rights”(ECHR) which contrary to what they want people to think, has nothing what so ever to do with the political entity of the “European Union”(EU).

Another reason I say,

“Paper Paper Never Data”

Is that just one piece of “sensitive information” can make a whole document classified for reasons that make some peoples minds spin.

It is to do with “de-anonymization” or “un-redaction” and something the late Prof Ross J. Anderson had great concernes about and thus frequently testified about.

Just a piece of information on it’s own rarely constitutes a harm, it needs to be linked to an individual or entity.

So a bank or credit card statement clearly identifies an individual.

The information that an online service for “gay dating” costs $12.34 / month is just information that is publicly available.

A charge/payment on a statement for $12.34 can directly indicate membership if it says “G-Day Play-Away” or the number of services that charge that fee/month is very very limited.

So the context becomes sufficiently clear and the potential harm exists. Thus all that has to be shown is that seeking this information is for the purpose of committing a harm such as discrimination of some form.